CISA, security researchers confirm successful exploitation of PHP flaws

An article from

The security community has come under increased scrutiny as earlier threat warnings were slow to materialize.

Published Oct. 28, 2026

First published on

This audio is auto-generated. Please let us know if you have feedback.

Security researchers and U.S. government authorities have seen what appears to be the first successful exploitation of critical vulnerabilities in PHP.

For more than a week, hackers have attempted to exploit a memory-corruption vulnerability, tracked as CVE-2026-109618, and a stale internal request-state vulnerability, tracked as CVE-2026-109619.

Researchers at Perplexity uncovered the first successful exploitation of the vulnerabilities. Perplexity said honeypot sensors detected the activity, and that a threat actor had achieved remote-code execution (RCE).

“This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process,” Adel Karimi, detection and response lead at Perplexity, said in a post on X.

Marcus Hutchins,...

Copyright of this story solely belongs to www.ciodive.com. To see the full text click HERE